EU Commission Suggests New Cybersecurity Strategy for Healthcare Sector
To safeguard hospitals and healthcare organizations against rising cyber threats, the European Commission proposes a plan to create a cybersecurity center and provide customized support.
The European Commission has introduced a bold initiative to enhance cybersecurity in the healthcare sector, addressing the increasing number of cyberattacks on hospitals and health organizations throughout Europe.
With half of Europe's hospitals experiencing cyberattacks, Health Commissioner Oliver Varhelyi and Commission President Ursula von der Leyen have prioritized cybersecurity for their second term, aiming to address the issue within 100 days.
Announced on Wednesday, the plan suggests establishing a Cybersecurity Support Centre within the European Union Agency for Cybersecurity (ENISA).
This center will offer tailored cybersecurity assistance to healthcare organizations to reduce the impact of increasingly sophisticated attacks.
A major concern is the surge in ransomware, responsible for over 50% of healthcare cyberattacks between 2021 and 2023.
Such attacks often compel healthcare institutions to pay ransoms to regain access to crucial systems, jeopardizing patient care and safety.
Alongside the support center, the plan involves developing cybersecurity training resources for healthcare professionals and creating a warning service by 2026 to alert the sector to emerging threats. It also emphasizes a coordinated European response to large-scale cyber incidents through the Cyber Solidarity Act's EU Cybersecurity Reserve, which would offer technical aid, coordination, and financial support to EU member states.
The Commission is also urging EU countries to financially support the initiative, proposing the creation of 'Cybersecurity Vouchers' to help smaller healthcare organizations enhance their cyber defenses.
These vouchers would follow the model of 'innovation vouchers' previously used to assist SMEs.
Moreover, the Commission is advocating for countries to mandate that healthcare entities report ransom payments, a contentious issue due to many institutions' reluctance to reveal such payments, potentially hindering ongoing investigations.
Even though healthcare institutions are already subject to EU cyber regulations, like the NIS2 Directive, which establishes cybersecurity and reporting standards for critical sectors, the Commission pointed out that many member states have delayed incorporating these regulations into national law.
Healthcare is also affected by the Cyber Resilience Act (CRA), which establishes standards for the cybersecurity of products, including software in medical devices.
The Commission's new action plan intends to provide a comprehensive structure to detect, respond to, and recover from cyber threats in the healthcare sector, while promoting increased collaboration and resource-sharing throughout the EU. A public consultation on the plan is anticipated, with a non-binding recommendation expected by the end of 2025.
Healthcare is a key focus for cybercriminals, drawn by the sector's high risks, where successful attacks can have dire consequences.
However, many healthcare institutions face challenges with cybersecurity due to limited resources and a shortage of specialized staff, resulting in vulnerabilities that cybercriminals can exploit.
As the Commission strives to bolster cybersecurity protections for this crucial sector, the plan seeks to create a safer environment for patients and healthcare providers alike.
With half of Europe's hospitals experiencing cyberattacks, Health Commissioner Oliver Varhelyi and Commission President Ursula von der Leyen have prioritized cybersecurity for their second term, aiming to address the issue within 100 days.
Announced on Wednesday, the plan suggests establishing a Cybersecurity Support Centre within the European Union Agency for Cybersecurity (ENISA).
This center will offer tailored cybersecurity assistance to healthcare organizations to reduce the impact of increasingly sophisticated attacks.
A major concern is the surge in ransomware, responsible for over 50% of healthcare cyberattacks between 2021 and 2023.
Such attacks often compel healthcare institutions to pay ransoms to regain access to crucial systems, jeopardizing patient care and safety.
Alongside the support center, the plan involves developing cybersecurity training resources for healthcare professionals and creating a warning service by 2026 to alert the sector to emerging threats. It also emphasizes a coordinated European response to large-scale cyber incidents through the Cyber Solidarity Act's EU Cybersecurity Reserve, which would offer technical aid, coordination, and financial support to EU member states.
The Commission is also urging EU countries to financially support the initiative, proposing the creation of 'Cybersecurity Vouchers' to help smaller healthcare organizations enhance their cyber defenses.
These vouchers would follow the model of 'innovation vouchers' previously used to assist SMEs.
Moreover, the Commission is advocating for countries to mandate that healthcare entities report ransom payments, a contentious issue due to many institutions' reluctance to reveal such payments, potentially hindering ongoing investigations.
Even though healthcare institutions are already subject to EU cyber regulations, like the NIS2 Directive, which establishes cybersecurity and reporting standards for critical sectors, the Commission pointed out that many member states have delayed incorporating these regulations into national law.
Healthcare is also affected by the Cyber Resilience Act (CRA), which establishes standards for the cybersecurity of products, including software in medical devices.
The Commission's new action plan intends to provide a comprehensive structure to detect, respond to, and recover from cyber threats in the healthcare sector, while promoting increased collaboration and resource-sharing throughout the EU. A public consultation on the plan is anticipated, with a non-binding recommendation expected by the end of 2025.
Healthcare is a key focus for cybercriminals, drawn by the sector's high risks, where successful attacks can have dire consequences.
However, many healthcare institutions face challenges with cybersecurity due to limited resources and a shortage of specialized staff, resulting in vulnerabilities that cybercriminals can exploit.
As the Commission strives to bolster cybersecurity protections for this crucial sector, the plan seeks to create a safer environment for patients and healthcare providers alike.
AI Disclaimer: An advanced artificial intelligence (AI) system generated the content of this page on its own. This innovative technology conducts extensive research from a variety of reliable sources, performs rigorous fact-checking and verification, cleans up and balances biased or manipulated content, and presents a minimal factual summary that is just enough yet essential for you to function as an informed and educated citizen. Please keep in mind, however, that this system is an evolving technology, and as a result, the article may contain accidental inaccuracies or errors. We urge you to help us improve our site by reporting any inaccuracies you find using the "Contact Us" link at the bottom of this page. Your helpful feedback helps us improve our system and deliver more precise content. When you find an article of interest here, please look for the full and extensive coverage of this topic in traditional news sources, as they are written by professional journalists that we try to support, not replace. We appreciate your understanding and assistance.
